CVE-2024-6390
CVE-2024-6390: Stored Cross-Site Scripting (XSS) Vulnerability in Quiz and Survey Master WordPress plugin. This vulnerability, present in versions before 9.1.0, allows high-privilege users to inject malicious scripts into Quiz settings. The insufficient sanitization and escaping of user inputs in the WordPress plugin creates a pathway for XSS attacks. While the CVSS score is 0, indicating minimal immediate impact, the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a potential risk, especially given the possibility of exploitation by authenticated users. Successful exploitation could lead to session hijacking, defacement, or redirection to malicious sites. Website administrators should update to version 9.1.0 or later immediately to mitigate this risk. This vulnerability highlights the importance of input validation and output encoding in web applications to prevent XSS attacks, safeguarding user data and maintaining website integrity. While the SVRS score is low, promptly patching is recommended to minimize potential risks.
Description:
CVE-2024-6390 is a Stored Cross-Site Scripting (XSS) vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 9.1.0. This vulnerability allows high-privilege users, such as contributors, to inject malicious scripts into the plugin's settings, potentially leading to account takeover, sensitive data theft, or website defacement.
Key Insights:
- SVRS Score: 50 indicates a moderate risk, highlighting the need for attention and timely remediation.
- Exploit Status: Active exploits have been published, making it crucial to patch immediately.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, urging organizations to take immediate action.
- In the Wild: The vulnerability is actively exploited by hackers, emphasizing the urgency of patching.
Mitigation Strategies:
- Update the Quiz and Survey Master plugin to version 9.1.0 or later.
- Implement input validation and sanitization measures to prevent malicious script injection.
- Regularly scan websites for vulnerabilities and patch promptly.
- Train staff on the importance of cybersecurity and the risks associated with XSS vulnerabilities.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.